bug: marketplace.json pins withhold downstream releases — zetetic-team-subagents stuck 6 releases back, cortex-viz 3, with no signal #179

The defect

.claude-plugin/marketplace.json in this repo defines the cortex-plugins marketplace, which is what ~/.claude/settings.json actually enables for cortex@, cortex-viz@ and zetetic-team-subagents@. It pins each downstream plugin by version. Those pins are stale on origin/main today:

Nothing updates these pins when the downstream repo releases. Verified 2026-07-24 by fast-forwarding a marketplace clone to current origin/main — the pins do not move:

$ git -C ~/.claude/plugins/marketplaces/cortex-plugins pull --ff-only origin main
$ python3 -c "... marketplace.json ..."
hypermnesia-mcp=v4.16.0, cortex=v4.15.0, cortex-viz=v2.6.3, zetetic-team-subagents=v2.29.0

Why this is a Cortex issue and not a downstream one

A downstream release does not reach users until this file changes. cdeust/zetetic-team-subagents cut v2.30.0 through v2.34.0 — the §15 No-Deviation Rule, the redaction quality gates, the Fable multi-model loops — and every one of those releases delivered to zero installs, because delivery is gated by a version string here that nothing bumps. Same for three cortex-viz releases.

The downstream repos did everything right: tagged, released, changelogged. The delivery path silently dropped it. That makes this repo the owner of the defect, and the failure mode is the worst kind — it produces no error, no warning, and no diff. A user running zetetic-team-subagents believes they are on the current rules; they are six releases behind and nothing says so. For a plugin whose entire product is rule currency, that means agents enforce a superseded standard while reporting compliance (cdeust/zetetic-team-subagents#52).

This is the §13 F2 class exactly: a degraded mode that is not explicit, not named in the output, and silently defaulted to.

Immediate remediation

Bump both pins to the current releases (zetetic-team-subagents v2.34.0, cortex-viz v2.7.1) and verify each loads.

Acceptance criteria — the pins must stop going stale

1. Both pins bumped to current, with each plugin verified to load at the new version (session transcript quoted, not a manifest diff read).
2. CI fails when a pin lags its upstream's latest release. A scheduled job resolves each pinned plugin's latest release tag and compares. Manual discipline has already been tried and produced a six-release gap; the check must be mechanical.
3. The check names the lagging plugin, the pinned version, the available version and the release count between them — enough for a maintainer to act without investigating.
4. Bumping is part of a documented release procedure, so a downstream release has a defined path to delivery. State explicitly whether the bump is automated (preferred: a repository-dispatch from the downstream release workflow) or manual-with-a-CI-gate, and wire whichever is chosen.
5. Fail-open on unreachable upstream — a rate-limited or offline GitHub API degrades to silence, never to a red build on an unrelated PR. The offline path is tested.
6. Every arm asserted (§13 A3), each with a named test: pin current (silent — negative assertion per G4), pin behind by N, plugin repo unreachable, malformed/absent release metadata, plugin removed upstream.
7. cortex (v4.15.0, ./plugins/cortex-deprecated) is audited in the same pass: either it is intentionally frozen — say so at the use site per §8 — or it is a third stale pin.

Relationship to cdeust/zetetic-team-subagents#52

#52 makes staleness visible to the user at runtime; this issue makes it impossible to introduce at release time. #52's added criterion 9 distinguishes install-lag from pin-lag and points the pin-lag arm at this issue by number. Both are required — a runtime notice that only ever says "a maintainer has not bumped a pin" is a worse outcome than the pin being correct.

Definition of Done

Completion Ledger (§13.2), one row per arm in criterion 6 with its asserting test, plus the CI run output showing the check firing on a deliberately stale pin and staying silent on a current one. Per §15.1 criterion 2 is not deferrable to a follow-up: bumping the pins without the mechanical check restores the state that produced this issue.